> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spellguard.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# @spellguard/ctls

> Cloud Transport Layer Security — attestation and verification

# @spellguard/ctls

Cloud Transport Layer Security for attestation and verification.

## Client Functions

| Function                               | Description                           |
| -------------------------------------- | ------------------------------------- |
| `fetchAndVerifyVerifier(url, hash)`    | Fetch and verify Verifier attestation |
| `verifyVerifierAttestation(doc, hash)` | Verify an attestation document        |
| `buildEvidence(options)`               | Build evidence claims                 |
| `signEvidence(evidence, key)`          | Sign evidence with Ed25519            |

## Server Functions

| Function                             | Description                                |
| ------------------------------------ | ------------------------------------------ |
| `generateSessionKeys()`              | Generate ephemeral session keys (RAM-only) |
| `generateAttestationDocument(nonce)` | Generate Verifier attestation              |
| `verifyEvidence(evidence)`           | Verify client evidence                     |
| `registerAgent(agent)`               | Register an authenticated agent            |
| `rotateChannelToken(agentId)`        | Rotate an agent's channel token            |

## Usage Example

```typescript theme={null}
import {
  fetchAndVerifyVerifier,
  buildEvidence,
  signEvidence
} from '@spellguard/ctls';

// Client-side: Verify the Verifier
const verifier = await fetchAndVerifyVerifier(
  'https://verifier.example.com',
  'sha384:expected-image-hash...'
);

if (!verifier.verified) {
  throw new Error(`Verification failed: ${verifier.error}`);
}

// Build and sign evidence
const evidence = buildEvidence({
  agentId: 'my-agent',
  codeHash: 'sha256:...',
  endpoint: 'https://my-agent.com/_spellguard/receive',
  agentCardUrl: 'https://my-agent.com/.well-known/agent.json',
});

const signed = await signEvidence(evidence, privateKey);
```